US20100146291A1 - Secure framework for invoking server-side apis using ajax - Google Patents

Secure framework for invoking server-side apis using ajax Download PDF

Info

Publication number
US20100146291A1
US20100146291A1 US12330008 US33000808A US2010146291A1 US 20100146291 A1 US20100146291 A1 US 20100146291A1 US 12330008 US12330008 US 12330008 US 33000808 A US33000808 A US 33000808A US 2010146291 A1 US2010146291 A1 US 2010146291A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
api
request
server
injection
security
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
US12330008
Other versions
US8332654B2 (en )
Inventor
Ananthalakshmi Anbuselvan
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Oracle International Corp
Original Assignee
Oracle International Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • H04L63/123Applying verification of the received information received data contents, e.g. message integrity
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic

Abstract

Techniques for securely invoking a server-side API from client-side Web application code using AJAX. In one set of embodiments, a request to invoke a server-side API is received from a client-side component of a Web application, where the request is sent asynchronously using AJAX. One or more security handlers are then invoked to process the request in a manner that mitigates various security attacks. In one embodiment, a security handler is invoked to defend against a plurality of different types of Web application/AJAX security attacks. In another embodiment, authentication and authorization security handlers are invoked to authenticate a user of the Web application that originated the request and determine whether the user is authorized to call the server-side API. In yet another embodiment, configuration is implemented at the data storage tier to enforce user-access and data security on data that is retrieved/stored as a result of invoking the server-side API.

Description

    BACKGROUND OF THE INVENTION
  • Embodiments of the present invention relate to Web applications, and more particularly relate to a secure framework for invoking server-side Application Programming Interfaces (APIs) from client-side Web Application code using AJAX.
  • Web applications are typically composed of two code layers: a client-side layer (comprising, e.g., one or more Web pages written in HTML, JavaScript, etc.) that is interpreted in a client Web browser and is responsible for the visual presentation of the Web application to a user, and a server-side layer (comprising, e.g., one or more programs written in Java, JSP, Perl, ASP, etc.) that runs on a Web server and is responsible for executing application functions and generating client-side code. Traditionally, these two layers interact according to a synchronous model. For example, if a particular Web page needs to submit data to server-side code running on a Web server, the client Web browser sends an HTTP request to the Web server and waits for a response. The server-side code then processes the request and returns an HTTP response to the Web browser, which causes the browser to reload the Web page (or load a new page) with the contents of the response.
  • A problem with this synchronous model of communication is that it requires the client-side Web page to be refreshed each time data is sent between the Web browser and Web server. Although this type of behavior may be acceptable for simple Web applications, it can be problematic for more complex Web applications that send frequent requests to (or receive frequent updates from) a Web server. In these cases, each request/update causes the entire client-side Web page to be redrawn, resulting in an awkward and unintuitive user interface experience.
  • To address the foregoing, various technologies have been developed in recent years that enable asynchronous communication between a Web browser and Web server. One such technology, known as AJAX (Asynchronous JavaScript and XML), makes use of JavaScript on the client-side to send a request to a Web server and to poll for a response in the background. When a response from the Web server is received, the contents of the response are displayed in the client-side Web page without reloading the entire page. Since the communication between the Web browser and Web server occurs independently of the visual presentation of the Web page to the user, a much more responsive and dynamic user interface experience can be achieved.
  • AJAX is particularly useful for Web applications that need to invoke server-side functions (e.g., Java APIs) from client-side code (e.g., JavaScript). For example, the “Google Suggest” feature found on www.google.com uses client-side JavaScript to invoke a server-side API when a user enters search terms into a text field. The server-side API returns a list of suggested search terms based on the user-entered terms and the list is displayed in a drop-down list in the text field. In this implementation, AJAX is used to asynchronously invoke the server-side API and dynamically display the list of suggested search terms without having to refresh the client-side Web page. A number of existing Web application frameworks, such as Direct Web Remoting (DWR) and Google Web Toolkit (GWT), enable this type of asynchronous remote procedure call functionality.
  • However, a significant problem with existing frameworks like DWR and GWT is that they do not adequately address the many different types of security vulnerabilities that are inherent in AJAX-based Web applications. Accordingly, it would be desirable to have a framework for invoking server-side APIs from client-side code using AJAX that provides a comprehensive defense against most, if not all, common security attacks.
  • BRIEF SUMMARY OF THE INVENTION
  • Embodiments of the present invention provide techniques for securely invoking a server-side API from client-side Web application code using AJAX. In one set of embodiments, a request to invoke a server-side API is received from a client-side component of a Web application, where the request is sent asynchronously using AJAX. One or more security handlers are then invoked to process the request in a manner that mitigates various security attacks. In one embodiment, a security handler is invoked to mitigate a plurality of different types of Web application and AJAX security attacks, such as Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), injection attacks, replay attacks, and the like. In another embodiment, authentication and authorization security handlers are invoked to authenticate a user of the Web application that originated the request and to determine whether the user is authorized to call the server-side API. In yet another embodiment, configuration is implemented at the data storage (e.g., database) tier to enforce user-access and data security on data that is retrieved or stored as a result of invoking the server-side API.
  • According to one embodiment of the present invention, a method for securely invoking a server-side API comprises receiving, from a client-side component of a Web application, a request to invoke an API hosted on a server, where the request is sent asynchronously by the client-side component using AJAX. The method further comprises invoking a security handler configured to process the request in a manner that mitigates a plurality of different types of Web application or AJAX security attacks. Examples of such Web application or AJAX security attacks include Cross Site Scripting, Cross Site Request Forgery, injection attacks, and replay attacks. Examples of injection attacks include SQL injection, PL/SQL injection, XML injection, HTML injection, and JavaScript injection. Once the security handler has been called, the API is invoked on the server and a response comprising output data generated by the API is sent to the client-side component.
  • In one set of embodiments, the method above is performed by a Java servlet running on the server. Additionally, the client-side component is JavaScript code running on a client Web browser, and the API is a Java API.
  • In one set of embodiments, the plurality of different types of Web application or AJAX security attacks further include illegal redirects and buffer overflows.
  • In one set of embodiments, the request received from the client-side component includes an API name, a class name, and one or more parameter values for the API.
  • In one set of embodiments, processing the request comprises validating the one or more parameter values against a white-list of valid characters or values. In another set of embodiments, processing the request comprises escaping code tags in the one or more parameter values. In yet another set of embodiments, processing the request comprises determining whether the one or more parameter values are signed using a context signature.
  • In one set of embodiments, the method above further comprises invoking an authentication security handler configured to authenticate a user of the Web application that originated the request, and invoking an authorization security handler configured to determine whether the user is authorized to invoke the API. In a particular embodiment, the Web application is built using the Oracle Applications (OA) Framework, and the authentication and authorization security handlers rely on security data specific to the OA Framework.
  • In one set of embodiments, the API is configured to query one or more database tables, and the results of the query are automatically filtered based on an identity of a user that originated the request and user-access permissions defined for the one or more database tables. In another set of embodiments, the API is configured to store data into one or more database tables, and the data is automatically encrypted prior to storage.
  • In one set of embodiments, a configuration file is maintained at the server including a list of server-side APIs and associated invocation permissions, and the method above further comprises determining, based on the list, whether the API can be invoked in response to the request.
  • According to another embodiment of the present invention, a server system is provided. The server system comprises a storage component configured to store code for an Application Programming Interface (API) and a processing component in communication with the storage component. The processing component is configured to receive, from a client-side component of a Web application, a request to invoke the API, where the request is sent asynchronously by the client-side component using AJAX. The processing component is further configured to invoke a security handler adapted to process the request in a manner that mitigates a plurality of different types of Web application or AJAX security attacks. Examples of such Web application or AJAX security attacks include Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), injection attacks, and replay attacks. Examples of injection attacks include SQL injection, PL/SQL injection, XML injection, HTML injection, and JavaScript injection. Once the security handler has been called, the processing component is configured to invoke the API and send a response comprising output data generated by the API to the client-side component.
  • According to another embodiment of the present invention, a machine-readable medium for a computer system is provided. The machine-readable medium has stored thereon program code for securely invoking a server-side Application Programming Interface (API), where the program code comprises code for receiving, from a client-side component of a Web application, a request to invoke an API hosted on a server, the request being sent asynchronously by the client-side component using AJAX. The program code further comprises code for invoking a security handler configured to process the request in a manner that mitigates a plurality of different types of Web application or AJAX security attacks. Examples of such Web application or AJAX security attacks include Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), injection attacks, and replay attacks. Examples of injection attacks include SQL injection, PL/SQL injection, XML injection, HTML injection, and JavaScript injection. The program code further comprises code for invoking the API on the server, and code for sending a response comprising output data generated by the API to the client-side component.
  • A further understanding of the nature and advantages of the embodiments disclosed herein may be realized by reference to the remaining portions of the specification and the attached drawings.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • Various embodiments in accordance with the present invention will be described with reference to the drawings, in which:
  • FIG. 1 is a flowchart illustrating steps performed in securely invoking a server-side API in accordance with an embodiment of the present invention.
  • FIG. 2 is a simplified block diagram illustrating functional components of a Web application system in accordance with an embodiment of the present invention.
  • FIG. 3 is a simplified block diagram illustrating a system environment that may be used in accordance with an embodiment of the present invention.
  • FIG. 4 is a simplified block diagram illustrating a computer system that may be used in accordance with an embodiment of the present invention.
  • DETAILED DESCRIPTION OF THE INVENTION
  • In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide an understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without some of these specific details.
  • Embodiments of the present invention provide techniques for securely invoking server-side APIs (such as Java APIs) from client-side Web application code (such as JavaScript) using AJAX. In one set of embodiments, the techniques described herein may be used in the enterprise software context to provide a standardized and secure mechanism for invoking server-side APIs in Web-based enterprise applications. In these embodiments, the techniques of the present invention may interface with (and take advantage of) security functions that are already implemented in existing enterprise application frameworks (such as the Oracle Applications Framework). In other embodiments, the techniques described herein may be used in a more general context to facilitate the secure invocation of server-side APIs from client-side code in any type of Web-based application.
  • FIG. 1 is a flowchart 100 illustrating the steps performed in securely invoking a server-side API of a Web application in accordance with an embodiment of the present invention. In various embodiments, the processing of flowchart 100 may be implemented in software, hardware, or combinations thereof. In one embodiment, the processing of flowchart 100 is performed by a Java servlet running on a Web server, such as servlet 208 of FIG. 2. In other embodiments, the processing of flowchart 100 may be performed by any type of server-side component in communication with a client-side component of a Web application. One of ordinary skill in the art would recognize many variations, modifications, and alternatives.
  • At step 102, a request to invoke an API hosted on a server is received from a client-side component of a Web application, where the request is sent asynchronously using AJAX. Typically, the client-side component will be JavaScript code running in a client Web browser, and the request will be an XMLHttpRequest object. The technical details for asynchronously submitting an XMLHttpRequest from JavaScript using AJAX is well-known in the art, and thus is not discussed in detail here.
  • In one set of embodiments, the API hosted on the server is a Java API. In these embodiments, the request may include, inter alia, a name of the API, a Java class of the API, and one or more input parameter values. The server-side API may be also be implemented in any one of a number of other programming languages, such as C++, Perl, and the like.
  • Once the request has been received, a first security handler is invoked, where the first security handler is configured to perform authentication and authorization functions with respect to the request (step 104). For example, in one embodiment, the first security handler is configured to authenticate a user of the Web application that originated the request. In another embodiment, the first security handler is configured to determine whether the user is authorized to invoke the API. Although the term “first security handler” implies a single security handler, it should be appreciated that the authentication and authorization functions attributed to the first security handler may be carried out by separate handlers/APIs.
  • In some embodiments, the Web application described in flowchart 100 may be built using an existing application framework, and may be designed to make use of standard security functions and metadata that are specific to that framework. For example, applications built using the Oracle Applications Framework are designed to store user identity, role, and responsibility information in an “FND” session context object at user login, which can then be validated against specific functions or pages using standard “FND” APIs. In these cases, the first security handler of step 104 may be configured to leverage these standard APIs (rather than relying on custom code) to carry out authentication and authorization.
  • By leveraging existing authentication/authorization mechanisms, embodiments of the present invention can be easily made to interoperate with a variety of existing application frameworks. In addition, since these existing mechanisms are typically well-tested and address common authentication/authorization-related vulnerabilities (e.g., password management, session state management, URL access, etc.), the overall security of the system is improved.
  • If the first security handler indicates that authentication and authorization are successful, a second security handler is invoked, where the second security handler is configured to process the request in a manner that mitigates a plurality of different types of Web application and AJAX security attacks (step 106). Examples of such attacks include Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), injection attacks (such as SQL, PL/SQL, XML, HTML, CSS, JSON, and JavaScript injection), replay attacks, illegal redirects, buffer overflows, and the like. Like the first security handler of step 104, the processing attributed to the second security handler may be carried out by a single handler or multiple handlers/APIs.
  • The second security handler is significant for at least two reasons. First, since the request received at step 102 is intended to invoke server-side code from a client, it is important to ensure that the request is not used as an attack vector to gain access to privileged code/data or otherwise compromise the server system. Second, since the request is received asynchronously via AJAX (and thus may not be readily observable from the visual presentation of the client-side Web page), it is difficult to identify and test for security vulnerabilities that may be exploited by the request. Accordingly, the second security handler of step 106 is designed to provide a comprehensive defense against most, if not all, common Web application/AJAX security attacks.
  • For example, in one embodiment, the second security handler is configured to validate any input parameter values included in the request against a “white-list” of known, valid characters or values. This check prevents the server-side API from being called with non-standard parameters, and thus prevents XSS and certain types of back-end injection attacks (e.g., SQL injection, PL/SQL injection, XML injection, etc.).
  • In another embodiment, the second security handler is configured to escape code tags (e.g., HTML tags, JavaScript tags, etc.) in any input parameter values. This measure avoids certain types of front-end injection attacks, such as HTML and JavaScript injection.
  • In yet another embodiment, the second security handler is configured to determine whether static parameter values (e.g., poplist values, LOV values, etc.) in the request are signed using a context (e.g., session-based) signature. This ensures that parameters or other data originating from the server are not tampered with, and thus provides a further defense against XSS and injection attacks. This technique may also be used to verify any request that changes the state of the server (e.g., POST requests), thereby preventing CSRF attacks.
  • Once the request has been processed by the second security handler in step 106, the API is invoked on the server based on the data (e.g., API name, input parameter values, etc.) in the request (step 108). In many cases, this invocation will result in one or more calls to a data storage (e.g., database) tier to store data received from the client-side component and/or retrieve data for transmittal to the client-side component. In these scenarios, the data storage tier may be configured to provide an additional level of security by enforcing user-access security and data security with respect to this stored/retrieved data.
  • For example, to enforce user-access security, the data storage tier may be configured to maintain user access policies for one or more database tables, where the user access policies control what rows or columns of the tables a particular user has access to. When the server-side API subsequently queries a database table, the results of the query may be automatically filtered at the data storage level based on the identity of the user that originated the invocation request and the user access policy for the table. In one set of embodiments, this functionality may be implemented using Virtual Private Database (VPD) technology available in Oracle Database 11g.
  • To enforce data security, the data storage tier may be configured to automatically encrypt sensitive data (such as Personally Identifiable Information (PII)) in the request prior to storing it, and to automatically obfuscate sensitive data upon retrieval so that is it not transmitted in plaintext format to the client-side component. In various embodiments, this functionality may be implemented using different mechanisms, such as the Transparent Data Encryption (TDE) technology included in Oracle Database 10g or the dbms_encrypt package.
  • Once the server-side API has been invoked and completed execution, a response comprising output data generated by the server-side API is sent to the client-side component (step 110). Since the initial request was sent using AJAX, the client-side component will generally process the response using an asynchronous callback function. The contents of the response are then be presented to the end-user.
  • In some embodiments, the server-side component (e.g., servlet) performing the steps of flowchart 100 may implement additional security safeguards. For example, in one embodiment, the server-side component may implement a secure error reporting/logging mechanism to avoid information leakage through improper error handling. Thus, if any of the steps of flowchart 100 encounter an unexpected error prior to completion, a generic error message (rather than, for example, a stack trace containing sensitive information) will be returned.
  • In another embodiment, the server-side component may maintain a configuration file that identifies which server-side APIs should (and/or should not) be invocable from the client-side component via AJAX. For example, the configuration file may include a list of API names and associated execute permissions (e.g., allow execute, disallow execute). This file may then be referenced at the time a request to invoke a server-side API is received to determine whether to allow the invocation.
  • It should be appreciated that the specific steps illustrated in FIG. 1 provide a particular method for securely invoking a server-side API according to an embodiment of the present invention. Other sequences of steps may also be performed according to alternative embodiments. For example, the individual steps illustrated in FIG. 1 may include multiple sub-steps that may be performed in various sequences as appropriate to the individual step. Furthermore, additional steps may be added, or existing steps may be removed, depending on the particular application. One of ordinary skill in the art would recognize many variations, modifications, and alternatives.
  • FIG. 2 is a simplified block diagram illustrating functional components of a Web application system 200 in accordance with an embodiment of the present invention. As shown, system 200 includes a client 202 comprising a client-side component 206 and a server 204 comprising a servlet 208, security handlers 210, 212, and a server-side API 214. In various embodiments, system 200 may be used to facilitate the secure invocation of server-side APIs as described with respect to flowchart 100 of FIG. 1.
  • For example, in one set of embodiments, servlet 208 is configured to receive a request to invoke a server-side API (such as API 214) from client-side component 206 and to process the request to defend against various security attacks. In an embodiment, this processing includes invoking authentication/authorization security handler 210 to authenticate a user of client 202 that originated the request and to determine whether the user is authorized to call API 214 (i.e., step 104 of FIG. 1). In a further embodiment, this processing includes invoking Web application/AJAX security handler 212 to mitigate a plurality of Web application and AJAX security attacks (i.e., step 106 of FIG. 1). By invoking these handlers, embodiments of the present invention are able to address most, if not all, of the common security vulnerabilities that affect AJAX-based Web applications.
  • In some embodiments, system 200 may include a data storage component such as database 216 for storing data accessed by server-side API 214. As discussed with respect to FIG. 1, database 216 may implement specific security mechanisms for safeguarding the data stored therein, such as user-access security and data security.
  • In further embodiments, system 200 may include a configuration file 218 for storing remote execution privileges for various server-side APIs. For example, configuration file 218 may include an entry identifying API 214 and indicating that API 214 can be remotely invoked by client-side component 206. As discussed with respect to FIG. 1, servlet 208 is configured to reference configuration file 218 at the time an invocation request is received from client-side component 206 to determine whether to allow the invocation. Although configuration file 218 is referred to as a “file,” one of ordinary skill in the art would recognize that the information contained therein (e.g., API names, permissions) may be stored in any type of logical storage format (e.g., flat file, database entry, etc.). Furthermore, configuration file 218 may be stored in a location local or remote to server 202.
  • FIG. 3 is a simplified block diagram illustrating a system environment 300 that may be used in accordance with an embodiment of the present invention. As shown, system environment 300 includes one or more client computing devices 302, 304, 306, 308 and a server 310. In one set of embodiments, client computing devices 302, 304, 306, 308 correspond to instances of client 202 of FIG. 2 and are configured to run a client-side component of a Web application, such as component 206. Further, server 310 corresponds to an instance of server 204 of FIG. 2 and is configured to run one or more server and/or middle-tier components of the Web application, such as components 208, 210, 212, 214. Although runtime system environment 300 is shown with four client computing devices and one server, any number of client computing devices and servers may be supported.
  • Client computing devices 302, 304, 306, 308 may be general purpose personal computers (including, e.g., personal computers and/or laptop computers running various versions of Microsoft Windows and/or Apple Macintosh operating systems), cell phones, smartphones, or PDAs (running software such as Microsoft Windows Mobile and being Internet, e-mail, SMS, Blackberry, or other communication protocol enabled), and/or workstation computers running any of a variety of commercially-available UNIX or UNIX-like operating systems (including without limitation the variety of GNU/Linux operating systems). Alternatively, client computing devices 302, 304, 306, 308 may be any other electronic device capable of communicating over a network (e.g., network 312 described below) with server 310.
  • Server 310 may be a general purpose computer, specialized server computer (including, e.g., a LINUX server, UNIX server, mid-range server, mainframe computer, rack-mounted server, etc.), server farm, server cluster, or any other appropriate arrangement and/or combination. Server 310 may run an operating system including any of those discussed above, as well as any commercially available server operating system. Server 310 may also run any of a variety of server applications and/or mid-tier applications, including web servers, Java virtual machines, application servers, database servers, and the like. As indicated above, in one set of embodiments, server 310 is adapted to run one or more server and/or middle-tier components (such as servlet 208 of FIG. 2) that are configured to receive and service requests from client computing devices 302, 304, 306, 308.
  • As shown, client computing devices 302, 304, 306, 308 and server 310 are communicatively coupled via a network 312. Network 312 may be any type of network that can support data communications using any of a variety of commercially-available protocols, including without limitation TCP/IP, SNA, IPX, AppleTalk, and the like. Merely by way of example, network 314 may be a local area network (LAN), such as an Ethernet network, a Token-Ring network and/or the like; a wide-area network; a virtual network, including without limitation a virtual private network (VPN); the Internet; an intranet; an extranet; a public switched telephone network (PSTN); an infra-red network; a wireless network (e.g., a network operating under any of the IEEE 802.11 suite of protocols, the Bluetooth protocol known in the art, and/or any other wireless protocol); and/or any combination of these and/or other networks.
  • System environment 300 may also include one or more databases 314. In one set of embodiments, database 314 corresponds to an instance of database 216 of FIG. 2, and is configured to store transactional data for a Web application running on server 310 and client computing devices 302, 304, 306, 308. Database 314 may also correspond to any other type of database or data storage component discussed in the present disclosure. Database 314 may reside in a variety of locations. By way of example, database 314 may reside on a storage medium local to (and/or resident in) one or more of the computers 302, 304, 306, 308, 310. Alternatively, database 314 may be remote from any or all of the computers 302, 304, 306, 308, 310 and/or in communication (e.g., via network 312) with one or more of these. In one set of embodiments, database 314 may reside in a storage-area network (SAN) familiar to those skilled in the art. Similarly, any necessary files for performing the functions attributed to the computers 302, 304, 306, 308, 310 may be stored locally on the respective computer and/or remotely on database 314, as appropriate. In one set of embodiments, database 314 is a relational database, such as Oracle 10g, that is adapted to store, update, and retrieve data in response to SQL-formatted commands.
  • FIG. 4 illustrates a computer system 400 that may be used in accordance with an embodiment of the present invention. In one set of embodiments, computer system 400 may be used to implement any of the computers 302, 304, 306, 308, 310 in system environment 300 described above. As shown, computer system 400 comprises hardware elements that may be electrically coupled via a bus 424. The hardware elements may include one or more central processing units (CPUs) 402, one or more input devices 404 (e.g., a mouse, a keyboard, etc.), and one or more output devices 406 (e.g., a display device, a printer, etc.). Computer system 400 may also include one or more storage devices 408. By way of example, the storage device(s) 408 may include devices such as magnetic disk drives, optical storage devices, and solid-state storage devices (e.g., random access memory (RAM), read-only memory (ROM), solid-state hard drives, etc.), which can be programmable, flash-updateable and/or the like.
  • Computer system 400 may additionally include a machine-readable storage media reader 412, a communications subsystem 414 (e.g., a modem, a network card (wireless or wired), an infra-red communication device, etc.), and working memory 418, which may include RAM and ROM devices as described above. In some embodiments, computer system 400 may also include a processing acceleration unit 416, which can include a digital signal processor (DSP), a special-purpose processor, and/or the like.
  • Machine-readable storage media reader 412 can further be connected to a machine-readable storage medium 410, together (and, optionally, in combination with storage device(s) 408) comprehensively representing remote, local, fixed, and/or removable storage devices/media for temporarily and/or more permanently containing machine-readable information. Communications system 414 may permit data to be exchanged with network 312 and/or any other computer described above with respect to system environment 300.
  • Computer system 400 may also comprise software elements, shown as being currently located within working memory 418, including an operating system 420 and/or other code 422, such as an application program (which may be a client application, Web browser, mid-tier application, RDBMS, etc.). It should be appreciated that alternative embodiments of computer system 400 may have numerous variations from that described above. For example, customized hardware might also be used and/or particular elements might be implemented in hardware, software, or both. Further, connection to other computing devices such as network input/output devices may be employed.
  • In one set of embodiments, the techniques described herein may be implemented as program code executable by a computer system (such as a computer system 400) and may be stored on machine-readable media. Machine-readable media may can include any appropriate media known or used in the art, including storage media and communication media, such as (but not limited to) volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage and/or transmission of information such as machine-readable instructions, data structures, program modules, or other data, including RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store or transmit the desired information and which can be accessed by a computer.
  • While the present invention has been described using a particular combination of hardware and software, it should be recognized that other combinations of hardware and software are also within the scope of the present invention. The present invention may be implemented only in hardware, or only in software, or using combinations thereof.
  • The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. Many variations of the invention will become apparent to those skilled in the art upon review of the disclosure. The scope of the invention should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the pending claims along with their full scope or equivalents.

Claims (22)

  1. 1. A method for securely invoking a server-side Application Programming Interface (API), the method comprising:
    receiving, from a client-side component of a Web application, a request to invoke an API hosted on a server, wherein the request is sent asynchronously by the client-side component using AJAX;
    invoking a security handler configured to process the request in a manner that mitigates a plurality of different types of Web application or AJAX security attacks;
    invoking the API on the server; and
    sending a response comprising output data generated by the API to the client-side component.
  2. 2. The method of claim 1, wherein the method is performed by a Java servlet running on the server.
  3. 3. The method of claim 1, wherein the client-side component is JavaScript code running in a Web browser.
  4. 4. The method of claim 1, wherein the API is a Java API.
  5. 5. The method of claim 1, wherein the plurality of different types of Web application or AJAX security attacks include Cross Site Scripting, Cross Site Request Forgery, injection attacks, and replay attacks.
  6. 6. The method of claim 5, wherein the injection attacks include SQL injection, PL/SQL injection, XML injection, HTML injection, and JavaScript injection.
  7. 7. The method of claim 5, wherein the plurality of different types of Web application or AJAX security attacks further include illegal redirects and buffer overflows.
  8. 8. The method of claim 1, wherein the request includes an API name, a class name, and one or more parameter values for the API.
  9. 9. The method of claim 8, wherein processing the request comprises validating the one or more parameter values against a white-list of valid characters or values.
  10. 10. The method of claim 8, wherein processing the request comprises escaping code tags in the one or more parameter values.
  11. 11. The method of claim 8, wherein processing the request comprises determining whether the one or more parameter values are signed using a context signature.
  12. 12. The method of claim 1 further comprising:
    invoking an authentication security handler configured to authenticate a user of the Web application that originated the request; and
    invoking an authorization security handler configured to determine whether the user is authorized to invoke the API.
  13. 13. The method of claim 12, wherein the Web application is built using the Oracle Applications (OA) Framework, and wherein the authentication and authorization security handlers rely on security data specific to the OA Framework.
  14. 14. The method of claim 1, wherein the API is configured to query one or more database tables, and wherein the results of the query are automatically filtered based on an identity of a user that originated the request and user-access permissions defined for the one or more database tables.
  15. 15. The method of claim 1, wherein the API is configured to store data into one or more database tables, and wherein the data is automatically encrypted prior to storage.
  16. 16. The method of claim 1, wherein a configuration file is maintained at the server including a list of server-side APIs and associated invocation permissions, and
    determining, based on the list, whether the API can be invoked in response to the request.
  17. 17. A server system comprising:
    a storage component configured to store code for an Application Programming Interface (API); and
    a processing component in communication with the storage component, wherein the processing component is configured to:
    receive, from a client-side component of a Web application, a request to invoke the API, wherein the request is sent asynchronously by the client-side component using AJAX;
    invoke a security handler configured to process the request in a manner that mitigates a plurality of different types of Web application or AJAX security attacks;
    invoke the API; and
    send a response comprising output data generated by the API to the client-side component.
  18. 18. The server system of claim 17, wherein the plurality of different types of Web application or AJAX security attacks include Cross Site Scripting, Cross Site Request Forgery, injection attacks, and replay attacks.
  19. 19. The server system of claim 18, wherein the injection attacks include SQL injection, PL/SQL injection, XML injection, HTML injection, and JavaScript injection.
  20. 20. A machine-readable medium for a computer system, the machine-readable medium having stored thereon program code for securely invoking a server-side Application Programming Interface (API), the program code comprising:
    code for receiving, from a client-side component of a Web application, a request to invoke an API hosted on a server, wherein the request is sent asynchronously by the client-side component using AJAX;
    code for invoking a security handler configured to process the request in a manner that mitigates a plurality of different types of Web application or AJAX security attacks;
    code for invoking the API on the server; and
    code for sending a response comprising output data generated by the API to the client-side component.
  21. 21. The machine-readable medium of claim 20, wherein the plurality of different types of Web application or AJAX security attacks include Cross Site Scripting, Cross Site Request Forgery, injection attacks, and replay attacks.
  22. 22. The machine-readable medium of claim 21, wherein the injection attacks include SQL injection, PL/SQL injection, XML injection, HTML injection, and JavaScript injection.
US12330008 2008-12-08 2008-12-08 Secure framework for invoking server-side APIs using AJAX Active 2031-01-22 US8332654B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12330008 US8332654B2 (en) 2008-12-08 2008-12-08 Secure framework for invoking server-side APIs using AJAX

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US12330008 US8332654B2 (en) 2008-12-08 2008-12-08 Secure framework for invoking server-side APIs using AJAX

Publications (2)

Publication Number Publication Date
US20100146291A1 true true US20100146291A1 (en) 2010-06-10
US8332654B2 US8332654B2 (en) 2012-12-11

Family

ID=42232397

Family Applications (1)

Application Number Title Priority Date Filing Date
US12330008 Active 2031-01-22 US8332654B2 (en) 2008-12-08 2008-12-08 Secure framework for invoking server-side APIs using AJAX

Country Status (1)

Country Link
US (1) US8332654B2 (en)

Cited By (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090205013A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization restrictions for multi-layer XML customization
US20090259993A1 (en) * 2008-04-11 2009-10-15 Oracle International Corporation Sandbox Support for Metadata in Running Applications
US20090313256A1 (en) * 2008-06-13 2009-12-17 Oracle International Corporation Reuse of shared metadata across applications via url protocol
US20100057836A1 (en) * 2008-09-03 2010-03-04 Oracle International Corporation System and method for integration of browser-based thin client applications within desktop rich client architecture
US20110078779A1 (en) * 2009-09-25 2011-03-31 Song Liu Anonymous Preservation of a Relationship and Its Application in Account System Management
CN102664872A (en) * 2012-03-05 2012-09-12 星云融创(北京)科技有限公司 System used for detecting and preventing attack to server in computer network and method thereof
US20120272133A1 (en) * 2011-04-21 2012-10-25 International Business Machines Corporation Handling unexpected responses to script executing in client-side application
US20130232545A1 (en) * 2012-03-05 2013-09-05 Jie Ma System and method for detecting and preventing attacks against a server in a computer network
US20130232266A1 (en) * 2010-01-29 2013-09-05 Novell, Inc. Techniques for generically accessing data
US8538998B2 (en) 2008-02-12 2013-09-17 Oracle International Corporation Caching and memory optimizations for multi-layer XML customization
US8560938B2 (en) 2008-02-12 2013-10-15 Oracle International Corporation Multi-layer XML customization
US8788542B2 (en) 2008-02-12 2014-07-22 Oracle International Corporation Customization syntax for multi-layer XML customization
US8799319B2 (en) 2008-09-19 2014-08-05 Oracle International Corporation System and method for meta-data driven, semi-automated generation of web services based on existing applications
US8856737B2 (en) 2009-11-18 2014-10-07 Oracle International Corporation Techniques for displaying customizations for composite applications
US20140331292A1 (en) * 2013-05-02 2014-11-06 International Business Machines Corporation Abstracted authenticated client connectivity application programming interface (api)
US20150019628A1 (en) * 2013-07-12 2015-01-15 Wensheng Li System and methods for accessing multi-origin content from web browser and application to web application testing
US8954942B2 (en) 2011-09-30 2015-02-10 Oracle International Corporation Optimizations using a BPEL compiler
US8966465B2 (en) 2008-02-12 2015-02-24 Oracle International Corporation Customization creation and update for multi-layer XML customization
US8990942B2 (en) 2013-02-18 2015-03-24 Wipro Limited Methods and systems for API-level intrusion detection
US9122520B2 (en) 2008-09-17 2015-09-01 Oracle International Corporation Generic wait service: pausing a BPEL process
US9361337B1 (en) * 2011-10-05 2016-06-07 Cumucus Systems Incorporated System for organizing and fast searching of massive amounts of data

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10015122B1 (en) 2012-10-18 2018-07-03 Sitting Man, Llc Methods and computer program products for processing a search
US10021052B1 (en) 2012-09-22 2018-07-10 Sitting Man, Llc Methods, systems, and computer program products for processing a data object identification request in a communication
US10033672B1 (en) 2012-10-18 2018-07-24 Sitting Man, Llc Methods and computer program products for browsing using a communicant identifier
US10013158B1 (en) 2012-09-22 2018-07-03 Sitting Man, Llc Methods, systems, and computer program products for sharing a data object in a data store via a communication
US10019135B1 (en) 2012-10-18 2018-07-10 Sitting Man, Llc Methods, and computer program products for constraining a communication exchange
US20140172998A1 (en) * 2012-12-16 2014-06-19 Deep River Ventures, Llc Methods, Systems, and Computer Program Products for Browsing Via a Communications Agent

Citations (93)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6397254B1 (en) * 1994-12-12 2002-05-28 Charles J. Northrup Access-method-independent exchange 3
US20020103660A1 (en) * 2000-11-30 2002-08-01 Kurt Cramon Generic transaction server
US20020129060A1 (en) * 2001-03-07 2002-09-12 International Business Machines Corporation System and method for generating multiple customizable interfaces for xml documents
US20020147757A1 (en) * 2001-04-07 2002-10-10 Ian Day Context-sensitive help for thin client-based business operations platform
US20030005117A1 (en) * 2001-06-29 2003-01-02 Kang Amy H. Pluggable authentication and access control for a messaging system
US20030034989A1 (en) * 2001-08-14 2003-02-20 Ibm Application editing apparatus and data processing method and program
US6545413B1 (en) * 1997-10-13 2003-04-08 Matsushita Electric Industrial Co., Ltd. Metal halide lamp
US20030172168A1 (en) * 2002-03-05 2003-09-11 Mak Mingchi S. Document conversion with merging
US20030172127A1 (en) * 2002-02-06 2003-09-11 Northrup Charles J. Execution of process by references to directory service
US20030172193A1 (en) * 2002-03-07 2003-09-11 Olsen Jesse Dale User interface generator and method of automatically generating a user interface
US20040046789A1 (en) * 2002-08-23 2004-03-11 Angelo Inanoria Extensible user interface (XUI) framework and development environment
US20040046787A1 (en) * 2001-06-01 2004-03-11 Attachmate Corporation System and method for screen connector design, configuration, and runtime access
US20040073565A1 (en) * 2000-10-31 2004-04-15 Kaufman Michael Philip System and method for generating automatic user interface for arbitrarily complex or large databases
US20040078424A1 (en) * 2002-10-16 2004-04-22 Nokia Corporation Web services via instant messaging
US20040111673A1 (en) * 2002-12-09 2004-06-10 Corel Corporation System and method for controlling user interface features of a web application
US20040111533A1 (en) * 2002-12-06 2004-06-10 International Business Machines Corporation Transformations as web services
US20040148588A1 (en) * 2003-01-23 2004-07-29 Electronic Data Systems Corporation System and method for automated code generation using language neutral software code
US20040181534A1 (en) * 2003-03-12 2004-09-16 Microsoft Corporation Customization of metadata describing objects in a computing environment
US20050044197A1 (en) * 2003-08-18 2005-02-24 Sun Microsystems.Inc. Structured methodology and design patterns for web services
US20050193061A1 (en) * 2003-05-16 2005-09-01 Patrick Schmidt Subprocesses and user interactions for a business process management integration server
US6947992B1 (en) * 2000-05-01 2005-09-20 International Business Machines Corporation Maintaining HTTP session affinity in a cluster environment
US20060010163A1 (en) * 2004-07-07 2006-01-12 Wolfgang Herzog Configuring computer systems with business configuration information
US20060015847A1 (en) * 2000-09-14 2006-01-19 Bea Systems, Inc. XML-based graphical user interface application development toolkit
US20060031750A1 (en) * 2003-10-14 2006-02-09 Waldorf Jerry A Web browser as web service server
US20060036463A1 (en) * 2004-05-21 2006-02-16 Patrick Paul B Liquid computing
US20060080117A1 (en) * 2004-10-12 2006-04-13 International Business Machines Corporation Maintaining integrity within an adaptive value chain involving cross enterprise interactions
US20060101038A1 (en) * 2004-10-25 2006-05-11 James Gabriel Extensible object-modelling mechanism
US20060106626A1 (en) * 2004-11-16 2006-05-18 Jun-Jang Jeng Method and apparatus of model driven business solution monitoring and control
US7062749B2 (en) * 2000-12-15 2006-06-13 Promenix, Inc. Measuring, monitoring and tracking enterprise communications and processes
US20060130047A1 (en) * 2004-11-30 2006-06-15 Microsoft Corporation System and apparatus for software versioning
US20060136832A1 (en) * 2004-12-17 2006-06-22 Siebel Systems, Inc. Flexible and extensible combination user interfaces
US20060143229A1 (en) * 2004-12-28 2006-06-29 International Business Machines Corporation Method and system for dynamic creation of service flows
US20060168355A1 (en) * 2005-01-24 2006-07-27 Michael Shenfield System and method for provisioning component applications
US20060165105A1 (en) * 2005-01-24 2006-07-27 Michael Shenfield System and method for managing communication for component applications
US20060168132A1 (en) * 2004-10-29 2006-07-27 International Business Machines Corporation Business messaging standards to web services
US20060184866A1 (en) * 2005-01-21 2006-08-17 Rees Robert T O Method of managing multiple resource identifiers
US20060206858A1 (en) * 2005-03-07 2006-09-14 Detlef Becker System arrangement and method for automated application development with user guidance
US20070016429A1 (en) * 2005-07-12 2007-01-18 Bournas Redha M Implementing production processes
US7188158B1 (en) * 2000-07-15 2007-03-06 Hewlett-Packard Development Company, L.P. System and method for component-based software development
US20070055936A1 (en) * 2005-08-30 2007-03-08 Microsoft Corporation Markup based extensibility for user interfaces
US20070113191A1 (en) * 2004-12-17 2007-05-17 Siebel Systems, Inc. Flexible and extensible combination user interfaces
US20070130205A1 (en) * 2005-12-05 2007-06-07 Microsoft Corporation Metadata driven user interface
US20070157078A1 (en) * 2005-12-30 2007-07-05 Discovery Productions, Inc. Method for combining input data with run-time parameters into xml output using xsl/xslt
US20070169199A1 (en) * 2005-09-09 2007-07-19 Forum Systems, Inc. Web service vulnerability metadata exchange system
US20070174763A1 (en) * 2006-01-23 2007-07-26 Hung-Yang Chang System and method for developing and enabling model-driven XML transformation framework for e-business
US20070174822A1 (en) * 2006-01-26 2007-07-26 Simon Moser Method for generating compatible partner processes in BPEL
US20070203956A1 (en) * 2006-02-28 2007-08-30 Microsoft Corporation Metadata Customization Using Diffgrams
US20080004887A1 (en) * 2006-06-30 2008-01-03 Frank Brunswig Systems and methods for integrating services
US20080028302A1 (en) * 2006-07-31 2008-01-31 Steffen Meschkat Method and apparatus for incrementally updating a web page
US7343360B1 (en) * 1998-05-13 2008-03-11 Siemens Power Transmission & Distribution, Inc. Exchange, scheduling and control system for electrical power
US20080065675A1 (en) * 2006-09-11 2008-03-13 Microsoft Corporation Flexible data presentation enabled by metadata
US20080077848A1 (en) * 2006-09-21 2008-03-27 International Business Machines Corporation Capturing and Processing Change Information in a Web-Type Environment
US20080083012A1 (en) * 2006-06-26 2008-04-03 Dachuan Yu Program instrumentation method and apparatus for constraining the behavior of embedded script in documents
US20080104617A1 (en) * 2006-11-01 2008-05-01 Microsoft Corporation Extensible user interface
US20080120557A1 (en) * 2006-11-16 2008-05-22 Bea Systems, Inc. Dynamic generated web ui for configuration
US20080126396A1 (en) * 2006-06-26 2008-05-29 Perceptive Software, Inc. System and method for implementing dynamic forms
US20080127124A1 (en) * 2006-10-26 2008-05-29 Gilfix Michael A Converged call flow and web service application integration using a processing engine
US20080162304A1 (en) * 2005-02-17 2008-07-03 Shopmedia Inc. Methods and Apparatus for Selling Shipping Services Through a Mediator's Web Site
US20080163164A1 (en) * 2007-01-03 2008-07-03 International Business Machines Corporation System and method for model-driven dashboard for business performance management
US20080183744A1 (en) * 2007-01-31 2008-07-31 Cognos Incorporated Method and system for business process management
US20080184201A1 (en) * 2007-01-26 2008-07-31 Microsoft Corporation Universal schema for representing management policy
US20080183479A1 (en) * 2007-01-25 2008-07-31 Masaru Iwashita Business process reconstruction method, and its program and computer
US20080275844A1 (en) * 2007-05-01 2008-11-06 Oracle International Corporation Crawlable applications
US20080313648A1 (en) * 2007-06-14 2008-12-18 Microsoft Corporation Protection and communication abstractions for web browsers
US20090031280A1 (en) * 2004-03-18 2009-01-29 International Business Machines Corporation Method for Generating an Executable Workflow Code from an Unstructured Cyclic Process Model and Method for Executing a Workflow Code of an Arbitrary Process Model
US7489033B2 (en) * 2006-11-10 2009-02-10 Intel Corporation Electronic assembly with hot spot cooling
US20090083297A1 (en) * 2007-09-26 2009-03-26 Sap Ag Apparatus and method of customizable model import and export to and from XML schema formats
US20090106494A1 (en) * 2007-10-19 2009-04-23 Patrick Knebel Allocating space in dedicated cache ways
US7536606B2 (en) * 2004-04-30 2009-05-19 Microsoft Corporation Error detection in web services systems
US20090144729A1 (en) * 2007-11-30 2009-06-04 Alejandro Guizar Portable business process deployment model across different application servers
US20090144716A1 (en) * 2007-12-04 2009-06-04 Bea Systems, Inc. Patch attachment facility
US20090150565A1 (en) * 2007-12-05 2009-06-11 Alcatel Lucent SOA infrastructure for application sensitive routing of web services
US20090157859A1 (en) * 2007-12-17 2009-06-18 Morris Robert P Methods And Systems For Accessing A Resource Based On URN Scheme Modifiers
US20090158237A1 (en) * 2007-12-14 2009-06-18 International Business Machines Corporation Method and apparatus for the design and development of service-oriented architecture (soa) solutions
US20090205013A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization restrictions for multi-layer XML customization
US20090204629A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Caching and memory optimizations for multi-layer xml customization
US20090204943A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization creation and update for multi-layer XML customization
US20090204567A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization syntax for multi-layer xml customization
US20090204884A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Multi-layer xml customization
US20100057482A1 (en) * 2008-08-28 2010-03-04 Oracle International Corporation Roundtrip merge of bpel processes and bpmn models
US20100057836A1 (en) * 2008-09-03 2010-03-04 Oracle International Corporation System and method for integration of browser-based thin client applications within desktop rich client architecture
US20100070973A1 (en) * 2008-09-17 2010-03-18 Oracle International Corporation Generic wait service: pausing a bpel process
US20100070553A1 (en) * 2008-09-15 2010-03-18 Oracle International Corporation Dynamic service invocation and service adaptation in bpel soa process
US20100082556A1 (en) * 2008-09-19 2010-04-01 Oracle International Corporation System and method for meta-data driven, semi-automated generation of web services based on existing applications
US20100132009A1 (en) * 2008-11-25 2010-05-27 Prakash Khemani Systems and Methods for HTTP Callouts for Policies
US7774477B2 (en) * 2000-12-01 2010-08-10 Microsoft Corporation Peer networking host framework and hosting API
US7783782B2 (en) * 2008-05-23 2010-08-24 Raytheon Company Dynamic runtime service oriented architecture
US7788338B2 (en) * 2005-09-21 2010-08-31 Sap Ag Web services message processing runtime framework
US7793340B2 (en) * 2007-11-21 2010-09-07 Novell, Inc. Cryptographic binding of authentication schemes
US7865544B2 (en) * 2007-06-26 2011-01-04 International Business Machines Corporation Method and system for providing XML-based asynchronous and interactive feeds for web applications
US20110023071A1 (en) * 2008-03-28 2011-01-27 Huawei Technologies Co., Ltd. Method, System, and Apparatus for Creating Content-on-Demand Service
US7933946B2 (en) * 2007-06-22 2011-04-26 Microsoft Corporation Detecting data propagation in a distributed system
US20110119651A1 (en) * 2009-11-18 2011-05-19 Oracle International Corporation Techniques related to customizations for composite applications

Family Cites Families (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7590644B2 (en) 1999-12-21 2009-09-15 International Business Machine Corporation Method and apparatus of streaming data transformation using code generator and translator
US7117216B2 (en) 2001-06-07 2006-10-03 Sun Microsystems, Inc. Method and apparatus for runtime merging of hierarchical trees
US20030025732A1 (en) 2001-07-31 2003-02-06 Prichard Scot D. Method and apparatus for providing customizable graphical user interface and screen layout
US7028310B2 (en) 2001-08-31 2006-04-11 Hewlett-Packard Development Company, L.P. Dynamic user interfaces for network services
US6641746B2 (en) 2001-09-28 2003-11-04 Agere Systems, Inc. Control of semiconductor processing
US6807636B2 (en) 2002-02-13 2004-10-19 Hitachi Computer Products (America), Inc. Methods and apparatus for facilitating security in a network
US7159224B2 (en) 2002-04-09 2007-01-02 Sun Microsystems, Inc. Method, system, and articles of manufacture for providing a servlet container based web service endpoint
US7219104B2 (en) 2002-04-29 2007-05-15 Sap Aktiengesellschaft Data cleansing
US20030233631A1 (en) 2002-06-13 2003-12-18 Ambrose Curry Web services development method
US7853899B1 (en) 2002-12-30 2010-12-14 Sap Aktiengesellschaft Configuring and extending a user interface
US7577964B2 (en) 2003-02-28 2009-08-18 Hewlett-Packard Development Company, L.P. System and methods for defining a binding for web-services
US7454483B2 (en) 2003-05-14 2008-11-18 Microsoft Corporation Method and apparatus for configuring servers
CA2776354A1 (en) 2003-06-05 2005-02-24 Intertrust Technologies Corporation Interoperable systems and methods for peer-to-peer service orchestration
EP1582975A1 (en) 2004-03-31 2005-10-05 Sap Ag Configuration based user interface generation
WO2006041554A3 (en) 2004-08-02 2007-02-22 Justsystems Corp Document processing and management approach to editing a document in a mark up language environment using undoable commands
US20070277095A1 (en) 2004-11-12 2007-11-29 Kazunori Ukigawa Data Processing Device And Data Processing Method
US7827494B1 (en) 2005-04-08 2010-11-02 Adobe Systems Incorporated Layout management using data-descriptive meta language documents
US20060235733A1 (en) 2005-04-13 2006-10-19 Marks Eric A System and method for providing integration of service-oriented architecture and Web services
KR100703754B1 (en) 2005-04-15 2007-04-06 삼성전자주식회사 Apparatus and method for processing web service
US7505990B2 (en) 2005-05-05 2009-03-17 International Business Machines Corporation Method for defining and generating document management applications for model-driven document management
US8171394B2 (en) 2005-06-24 2012-05-01 Microsoft Corporation Methods and systems for providing a customized user interface for viewing and editing meta-data
US7529977B2 (en) 2006-05-31 2009-05-05 Microsoft Corporation Automated extensible user interface testing
US20070282885A1 (en) 2006-05-31 2007-12-06 Baude Brent J Method and System For Application Interaction
US7657557B2 (en) 2007-03-30 2010-02-02 Fmr Llc Generating code on a network
US8381113B2 (en) 2007-04-06 2013-02-19 Microsoft Corporation Metadata-driven automatic UI code generation
US9268538B2 (en) 2007-05-02 2016-02-23 Sugarcrm Inc. Metadata driven user interface system and method
US20080276260A1 (en) 2007-05-03 2008-11-06 Microsoft Corporation Adaptive User Interface Verification
CN101311903B (en) 2007-05-22 2011-05-18 国际商业机器公司 Method and device for reusing component of software system based on component
US8782604B2 (en) 2008-04-11 2014-07-15 Oracle International Corporation Sandbox support for metadata in running applications
US8667031B2 (en) 2008-06-13 2014-03-04 Oracle International Corporation Reuse of shared metadata across applications via URL protocol

Patent Citations (101)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7535927B1 (en) * 1994-12-12 2009-05-19 Northrup Charles J Subscription-based services
US6421705B1 (en) * 1994-12-12 2002-07-16 Charles J. Northrup Service provider application program communicating with service provider application process
US6397254B1 (en) * 1994-12-12 2002-05-28 Charles J. Northrup Access-method-independent exchange 3
US6779000B1 (en) * 1994-12-12 2004-08-17 Charles J. Northrup Access method with process interactive service
US6922705B1 (en) * 1994-12-12 2005-07-26 Charles J. Northrup Access-method-independent exchange with communication request
US6545413B1 (en) * 1997-10-13 2003-04-08 Matsushita Electric Industrial Co., Ltd. Metal halide lamp
US7343360B1 (en) * 1998-05-13 2008-03-11 Siemens Power Transmission & Distribution, Inc. Exchange, scheduling and control system for electrical power
US6947992B1 (en) * 2000-05-01 2005-09-20 International Business Machines Corporation Maintaining HTTP session affinity in a cluster environment
US7188158B1 (en) * 2000-07-15 2007-03-06 Hewlett-Packard Development Company, L.P. System and method for component-based software development
US20060015847A1 (en) * 2000-09-14 2006-01-19 Bea Systems, Inc. XML-based graphical user interface application development toolkit
US20040073565A1 (en) * 2000-10-31 2004-04-15 Kaufman Michael Philip System and method for generating automatic user interface for arbitrarily complex or large databases
US20020103660A1 (en) * 2000-11-30 2002-08-01 Kurt Cramon Generic transaction server
US7774477B2 (en) * 2000-12-01 2010-08-10 Microsoft Corporation Peer networking host framework and hosting API
US20060150156A1 (en) * 2000-12-15 2006-07-06 Cyr Vincent R Apparatus and systems for measuring, monitoring, tracking and simulating enterprise communications and processes
US7062749B2 (en) * 2000-12-15 2006-06-13 Promenix, Inc. Measuring, monitoring and tracking enterprise communications and processes
US20020129060A1 (en) * 2001-03-07 2002-09-12 International Business Machines Corporation System and method for generating multiple customizable interfaces for xml documents
US20020147757A1 (en) * 2001-04-07 2002-10-10 Ian Day Context-sensitive help for thin client-based business operations platform
US20040046787A1 (en) * 2001-06-01 2004-03-11 Attachmate Corporation System and method for screen connector design, configuration, and runtime access
US20030005117A1 (en) * 2001-06-29 2003-01-02 Kang Amy H. Pluggable authentication and access control for a messaging system
US20030034989A1 (en) * 2001-08-14 2003-02-20 Ibm Application editing apparatus and data processing method and program
US20030172127A1 (en) * 2002-02-06 2003-09-11 Northrup Charles J. Execution of process by references to directory service
US20030172168A1 (en) * 2002-03-05 2003-09-11 Mak Mingchi S. Document conversion with merging
US20030172193A1 (en) * 2002-03-07 2003-09-11 Olsen Jesse Dale User interface generator and method of automatically generating a user interface
US20040046789A1 (en) * 2002-08-23 2004-03-11 Angelo Inanoria Extensible user interface (XUI) framework and development environment
US20040078424A1 (en) * 2002-10-16 2004-04-22 Nokia Corporation Web services via instant messaging
US20040111533A1 (en) * 2002-12-06 2004-06-10 International Business Machines Corporation Transformations as web services
US20040111673A1 (en) * 2002-12-09 2004-06-10 Corel Corporation System and method for controlling user interface features of a web application
US20040148588A1 (en) * 2003-01-23 2004-07-29 Electronic Data Systems Corporation System and method for automated code generation using language neutral software code
US20040181534A1 (en) * 2003-03-12 2004-09-16 Microsoft Corporation Customization of metadata describing objects in a computing environment
US20050193061A1 (en) * 2003-05-16 2005-09-01 Patrick Schmidt Subprocesses and user interactions for a business process management integration server
US20050044197A1 (en) * 2003-08-18 2005-02-24 Sun Microsystems.Inc. Structured methodology and design patterns for web services
US20060031750A1 (en) * 2003-10-14 2006-02-09 Waldorf Jerry A Web browser as web service server
US20090031280A1 (en) * 2004-03-18 2009-01-29 International Business Machines Corporation Method for Generating an Executable Workflow Code from an Unstructured Cyclic Process Model and Method for Executing a Workflow Code of an Arbitrary Process Model
US7536606B2 (en) * 2004-04-30 2009-05-19 Microsoft Corporation Error detection in web services systems
US20060036463A1 (en) * 2004-05-21 2006-02-16 Patrick Paul B Liquid computing
US20060010163A1 (en) * 2004-07-07 2006-01-12 Wolfgang Herzog Configuring computer systems with business configuration information
US20060080117A1 (en) * 2004-10-12 2006-04-13 International Business Machines Corporation Maintaining integrity within an adaptive value chain involving cross enterprise interactions
US20060101038A1 (en) * 2004-10-25 2006-05-11 James Gabriel Extensible object-modelling mechanism
US20060168132A1 (en) * 2004-10-29 2006-07-27 International Business Machines Corporation Business messaging standards to web services
US20060106626A1 (en) * 2004-11-16 2006-05-18 Jun-Jang Jeng Method and apparatus of model driven business solution monitoring and control
US20060130047A1 (en) * 2004-11-30 2006-06-15 Microsoft Corporation System and apparatus for software versioning
US7984424B2 (en) * 2004-11-30 2011-07-19 Microsoft Corporation Isolating declarative code to preserve customizations
US20070113191A1 (en) * 2004-12-17 2007-05-17 Siebel Systems, Inc. Flexible and extensible combination user interfaces
US20060136832A1 (en) * 2004-12-17 2006-06-22 Siebel Systems, Inc. Flexible and extensible combination user interfaces
US20060143229A1 (en) * 2004-12-28 2006-06-29 International Business Machines Corporation Method and system for dynamic creation of service flows
US20060184866A1 (en) * 2005-01-21 2006-08-17 Rees Robert T O Method of managing multiple resource identifiers
US20060165105A1 (en) * 2005-01-24 2006-07-27 Michael Shenfield System and method for managing communication for component applications
US20060168355A1 (en) * 2005-01-24 2006-07-27 Michael Shenfield System and method for provisioning component applications
US20080162304A1 (en) * 2005-02-17 2008-07-03 Shopmedia Inc. Methods and Apparatus for Selling Shipping Services Through a Mediator's Web Site
US20060206858A1 (en) * 2005-03-07 2006-09-14 Detlef Becker System arrangement and method for automated application development with user guidance
US20070016429A1 (en) * 2005-07-12 2007-01-18 Bournas Redha M Implementing production processes
US20070055936A1 (en) * 2005-08-30 2007-03-08 Microsoft Corporation Markup based extensibility for user interfaces
US20070169199A1 (en) * 2005-09-09 2007-07-19 Forum Systems, Inc. Web service vulnerability metadata exchange system
US7788338B2 (en) * 2005-09-21 2010-08-31 Sap Ag Web services message processing runtime framework
US20070130205A1 (en) * 2005-12-05 2007-06-07 Microsoft Corporation Metadata driven user interface
US20070157078A1 (en) * 2005-12-30 2007-07-05 Discovery Productions, Inc. Method for combining input data with run-time parameters into xml output using xsl/xslt
US20070174763A1 (en) * 2006-01-23 2007-07-26 Hung-Yang Chang System and method for developing and enabling model-driven XML transformation framework for e-business
US20070174822A1 (en) * 2006-01-26 2007-07-26 Simon Moser Method for generating compatible partner processes in BPEL
US20070203956A1 (en) * 2006-02-28 2007-08-30 Microsoft Corporation Metadata Customization Using Diffgrams
US20080126396A1 (en) * 2006-06-26 2008-05-29 Perceptive Software, Inc. System and method for implementing dynamic forms
US20080083012A1 (en) * 2006-06-26 2008-04-03 Dachuan Yu Program instrumentation method and apparatus for constraining the behavior of embedded script in documents
US20080004887A1 (en) * 2006-06-30 2008-01-03 Frank Brunswig Systems and methods for integrating services
US20080028302A1 (en) * 2006-07-31 2008-01-31 Steffen Meschkat Method and apparatus for incrementally updating a web page
US20080065675A1 (en) * 2006-09-11 2008-03-13 Microsoft Corporation Flexible data presentation enabled by metadata
US20080077848A1 (en) * 2006-09-21 2008-03-27 International Business Machines Corporation Capturing and Processing Change Information in a Web-Type Environment
US7895512B2 (en) * 2006-09-21 2011-02-22 International Business Machines Corporation Capturing and processing change information in a web-type environment
US20080127124A1 (en) * 2006-10-26 2008-05-29 Gilfix Michael A Converged call flow and web service application integration using a processing engine
US20080104617A1 (en) * 2006-11-01 2008-05-01 Microsoft Corporation Extensible user interface
US7489033B2 (en) * 2006-11-10 2009-02-10 Intel Corporation Electronic assembly with hot spot cooling
US20080120557A1 (en) * 2006-11-16 2008-05-22 Bea Systems, Inc. Dynamic generated web ui for configuration
US20080163164A1 (en) * 2007-01-03 2008-07-03 International Business Machines Corporation System and method for model-driven dashboard for business performance management
US20080183479A1 (en) * 2007-01-25 2008-07-31 Masaru Iwashita Business process reconstruction method, and its program and computer
US20080184201A1 (en) * 2007-01-26 2008-07-31 Microsoft Corporation Universal schema for representing management policy
US20080183744A1 (en) * 2007-01-31 2008-07-31 Cognos Incorporated Method and system for business process management
US20080275844A1 (en) * 2007-05-01 2008-11-06 Oracle International Corporation Crawlable applications
US20080313648A1 (en) * 2007-06-14 2008-12-18 Microsoft Corporation Protection and communication abstractions for web browsers
US7933946B2 (en) * 2007-06-22 2011-04-26 Microsoft Corporation Detecting data propagation in a distributed system
US7865544B2 (en) * 2007-06-26 2011-01-04 International Business Machines Corporation Method and system for providing XML-based asynchronous and interactive feeds for web applications
US20090083297A1 (en) * 2007-09-26 2009-03-26 Sap Ag Apparatus and method of customizable model import and export to and from XML schema formats
US20090106494A1 (en) * 2007-10-19 2009-04-23 Patrick Knebel Allocating space in dedicated cache ways
US7793340B2 (en) * 2007-11-21 2010-09-07 Novell, Inc. Cryptographic binding of authentication schemes
US20090144729A1 (en) * 2007-11-30 2009-06-04 Alejandro Guizar Portable business process deployment model across different application servers
US20090144716A1 (en) * 2007-12-04 2009-06-04 Bea Systems, Inc. Patch attachment facility
US20090150565A1 (en) * 2007-12-05 2009-06-11 Alcatel Lucent SOA infrastructure for application sensitive routing of web services
US20090158237A1 (en) * 2007-12-14 2009-06-18 International Business Machines Corporation Method and apparatus for the design and development of service-oriented architecture (soa) solutions
US20090157859A1 (en) * 2007-12-17 2009-06-18 Morris Robert P Methods And Systems For Accessing A Resource Based On URN Scheme Modifiers
US20090204567A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization syntax for multi-layer xml customization
US20090205013A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization restrictions for multi-layer XML customization
US20090204884A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Multi-layer xml customization
US20090204943A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization creation and update for multi-layer XML customization
US20090204629A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Caching and memory optimizations for multi-layer xml customization
US20110023071A1 (en) * 2008-03-28 2011-01-27 Huawei Technologies Co., Ltd. Method, System, and Apparatus for Creating Content-on-Demand Service
US7783782B2 (en) * 2008-05-23 2010-08-24 Raytheon Company Dynamic runtime service oriented architecture
US20100057482A1 (en) * 2008-08-28 2010-03-04 Oracle International Corporation Roundtrip merge of bpel processes and bpmn models
US20100057836A1 (en) * 2008-09-03 2010-03-04 Oracle International Corporation System and method for integration of browser-based thin client applications within desktop rich client architecture
US20100070553A1 (en) * 2008-09-15 2010-03-18 Oracle International Corporation Dynamic service invocation and service adaptation in bpel soa process
US20100070973A1 (en) * 2008-09-17 2010-03-18 Oracle International Corporation Generic wait service: pausing a bpel process
US20100082556A1 (en) * 2008-09-19 2010-04-01 Oracle International Corporation System and method for meta-data driven, semi-automated generation of web services based on existing applications
US20100132009A1 (en) * 2008-11-25 2010-05-27 Prakash Khemani Systems and Methods for HTTP Callouts for Policies
US20110119651A1 (en) * 2009-11-18 2011-05-19 Oracle International Corporation Techniques related to customizations for composite applications
US20110119649A1 (en) * 2009-11-18 2011-05-19 Oracle International Corporation Techniques for displaying customizations for composite applications

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"Oracle Application Framework", Oracle, December 2006, pp. 1-242. *
Curphey et al., "Web Application Security Assessment Tools", IEEE, 2006, pp. 32-41. *
DiPaola et al., "Subverting Ajax", December 2006, 23rd CCC Conference, pp. 1-8. *

Cited By (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8538998B2 (en) 2008-02-12 2013-09-17 Oracle International Corporation Caching and memory optimizations for multi-layer XML customization
US8966465B2 (en) 2008-02-12 2015-02-24 Oracle International Corporation Customization creation and update for multi-layer XML customization
US8875306B2 (en) 2008-02-12 2014-10-28 Oracle International Corporation Customization restrictions for multi-layer XML customization
US8788542B2 (en) 2008-02-12 2014-07-22 Oracle International Corporation Customization syntax for multi-layer XML customization
US8560938B2 (en) 2008-02-12 2013-10-15 Oracle International Corporation Multi-layer XML customization
US20090205013A1 (en) * 2008-02-12 2009-08-13 Oracle International Corporation Customization restrictions for multi-layer XML customization
US8782604B2 (en) 2008-04-11 2014-07-15 Oracle International Corporation Sandbox support for metadata in running applications
US20090259993A1 (en) * 2008-04-11 2009-10-15 Oracle International Corporation Sandbox Support for Metadata in Running Applications
US20090313256A1 (en) * 2008-06-13 2009-12-17 Oracle International Corporation Reuse of shared metadata across applications via url protocol
US8667031B2 (en) 2008-06-13 2014-03-04 Oracle International Corporation Reuse of shared metadata across applications via URL protocol
US9606778B2 (en) 2008-09-03 2017-03-28 Oracle International Corporation System and method for meta-data driven, semi-automated generation of web services based on existing applications
US8996658B2 (en) 2008-09-03 2015-03-31 Oracle International Corporation System and method for integration of browser-based thin client applications within desktop rich client architecture
US20100057836A1 (en) * 2008-09-03 2010-03-04 Oracle International Corporation System and method for integration of browser-based thin client applications within desktop rich client architecture
US9122520B2 (en) 2008-09-17 2015-09-01 Oracle International Corporation Generic wait service: pausing a BPEL process
US8799319B2 (en) 2008-09-19 2014-08-05 Oracle International Corporation System and method for meta-data driven, semi-automated generation of web services based on existing applications
US20110078779A1 (en) * 2009-09-25 2011-03-31 Song Liu Anonymous Preservation of a Relationship and Its Application in Account System Management
US8856737B2 (en) 2009-11-18 2014-10-07 Oracle International Corporation Techniques for displaying customizations for composite applications
US8869108B2 (en) 2009-11-18 2014-10-21 Oracle International Corporation Techniques related to customizations for composite applications
US9515948B2 (en) * 2010-01-29 2016-12-06 Novell, Inc. Techniques for generically accessing data
US20130232266A1 (en) * 2010-01-29 2013-09-05 Novell, Inc. Techniques for generically accessing data
US9026902B2 (en) 2011-04-21 2015-05-05 International Business Machines Corporation Handling unexpected responses to script executing in client-side application
US20120272133A1 (en) * 2011-04-21 2012-10-25 International Business Machines Corporation Handling unexpected responses to script executing in client-side application
US8954942B2 (en) 2011-09-30 2015-02-10 Oracle International Corporation Optimizations using a BPEL compiler
US9396287B1 (en) 2011-10-05 2016-07-19 Cumulus Systems, Inc. System for organizing and fast searching of massive amounts of data
US9614715B2 (en) 2011-10-05 2017-04-04 Cumulus Systems Inc. System and a process for searching massive amounts of time-series performance data using regular expressions
US9477784B1 (en) 2011-10-05 2016-10-25 Cumulus Systems, Inc System for organizing and fast searching of massive amounts of data
US9479385B1 (en) 2011-10-05 2016-10-25 Cumulus Systems, Inc. System for organizing and fast searching of massive amounts of data
US9361337B1 (en) * 2011-10-05 2016-06-07 Cumucus Systems Incorporated System for organizing and fast searching of massive amounts of data
US10044575B1 (en) 2011-10-05 2018-08-07 Cumulus Systems Inc. System for organizing and fast searching of massive amounts of data
US8752134B2 (en) * 2012-03-05 2014-06-10 Jie Ma System and method for detecting and preventing attacks against a server in a computer network
CN102664872A (en) * 2012-03-05 2012-09-12 星云融创(北京)科技有限公司 System used for detecting and preventing attack to server in computer network and method thereof
US20130232545A1 (en) * 2012-03-05 2013-09-05 Jie Ma System and method for detecting and preventing attacks against a server in a computer network
US8990942B2 (en) 2013-02-18 2015-03-24 Wipro Limited Methods and systems for API-level intrusion detection
US20140331292A1 (en) * 2013-05-02 2014-11-06 International Business Machines Corporation Abstracted authenticated client connectivity application programming interface (api)
US9386010B2 (en) * 2013-05-02 2016-07-05 Globalfoundries Inc. Abstracted authenticated client connectivity application programming interface (API)
US20150019628A1 (en) * 2013-07-12 2015-01-15 Wensheng Li System and methods for accessing multi-origin content from web browser and application to web application testing

Also Published As

Publication number Publication date Type
US8332654B2 (en) 2012-12-11 grant

Similar Documents

Publication Publication Date Title
US8136148B1 (en) Reusable authentication experience tool
US20100037303A1 (en) Form Filling with Digital Identities, and Automatic Password Generation
US20110154130A1 (en) Method and apparatus for secure cross-site scripting
US8544072B1 (en) Single sign-on service
US20130254855A1 (en) Dynamic rendering of a document object model
US20130086658A1 (en) Privileged account manager, access management
US20130086669A1 (en) Mobile application, single sign-on management
US20140208408A1 (en) Methods and apparatus to facilitate single sign-on services
US20130111586A1 (en) Computing security mechanism
US7975308B1 (en) Method and apparatus to secure user confidential data from untrusted browser extensions
US20140129920A1 (en) Enhanced Document and Event Mirroring for Accessing Internet Content
US20120066346A1 (en) Reputation checking obtained files
US20120167217A1 (en) Systems and methods to detect and neutralize malware infected electronic communications
US20130347070A1 (en) System and method for embedding first party widgets in third-party applications
US20100106767A1 (en) Automatically securing distributed applications
US20130227677A1 (en) Password authentication
US20130247204A1 (en) System and method for application security assessment
US20080295178A1 (en) Indicating SQL injection attack vulnerability with a stored value
US8347380B1 (en) Protecting users from accidentally disclosing personal information in an insecure environment
US20110321133A1 (en) System and method for authenticating web users
US20140075185A1 (en) Securely handling server certificate errors in synchronization communication
US20130055397A1 (en) Detecting stored cross-site scripting vulnerabilities in web applications
US20120096261A1 (en) Method and apparatus for controlling access to encrypted network communication channels
US20150271188A1 (en) Client/server security by an intermediary executing instructions received from a server and rendering client application instructions
US20120179744A1 (en) Techniques for detecting inactive browser windows

Legal Events

Date Code Title Description
AS Assignment

Owner name: ORACLE INTERNATIONAL CORPORATION,CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ANBUSELVAN, ANANTHALAKSHMI;REEL/FRAME:021940/0427

Effective date: 20081205

Owner name: ORACLE INTERNATIONAL CORPORATION, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ANBUSELVAN, ANANTHALAKSHMI;REEL/FRAME:021940/0427

Effective date: 20081205

CC Certificate of correction
FPAY Fee payment

Year of fee payment: 4